webeasy

Meme Contest

alfactf

Task: Meme voting platform requiring 1337 votes to win. Solution: Captcha bypass via None-to-string type confusion - str(session.get("captcha_text")) returns "None" when not set, allowing votes with captcha_input="NONE" without visiting the captcha page.

$ ls tags/ techniques/
flaskcaptcha_bypasssession_manipulationtype_confusionpythonnone_stringvoting_manipulationlogic_flaw
Captcha bypass via None-to-string type confusionSession state manipulationAutomated voting with parallel requests
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]